Descope, ServiceNow target shadow AI agents with identity and governance controls

Descope’s Agentic Identity Hub 3.0 targets agents that workers adopt or build faster than security and information technology teams can inventory. The company said many run on shared, long-lived credentials with no recorded owner. It cited Verizon Communications Inc.’s 2026 Data Breach Investigations Report, which found regular AI use on corporate devices had spread to 45% of employees and that roughly two-thirds of those users sign in to AI services with a personal account.

To register agents, Descope now requires employees to request them through an Agent Onboarding Portal. Each request starts in a self-service catalog and specifies what the agent will connect to, including individual data sources and Model Context Protocol servers. Nothing is provisioned until a reviewer approves. Approved agents receive an accountable owner and scoped access. Descope said the workflow is quick enough that teams have no reason to route around it.

Many agents employees use were built by others, and products such as Anthropic PBC’s Claude, Anysphere Inc.’s Cursor and third-party MCP servers cannot be instrumented by the organizations running them, leaving security teams without a place to enforce policy or capture logs. Version 3.0 integrates natively with MCP gateways, including the Agentic AI Foundation’s open-source agentgateway project. That places a single identity and policy layer in front of every agent and MCP server in use, including outside clients such as OpenAI Group PBC’s ChatGPT.

Descope also targets static client secrets, which tend to leak into code repositories and rarely get rotated. Under new client authentication options, an agent can sign a short-lived assertion with a private key that never leaves the client. Internal agents get something close to single sign-on: sign-in happens once through the company’s existing identity provider, and access to each MCP server follows without further login or consent screens. Descope said policy is evaluated on every request. Administrators can pull back an agent’s access from one place without reissuing credentials. The feature relies on identity assertion grants, the mechanism that also underpins Cross-App Access, which Descope began supporting in September.

Descope co-founder and Chief Executive Slavik Markovich said much of the hub’s early traction came from customer-facing agents and MCP servers. Customers kept raising a different problem on the inside, he said, with employees “spinning up agents faster than anyone could track them.” The Agentic Identity Hub handles authentication and access control for hundreds of MCP servers and more than 1 million agent identities, according to the company. Descope is venture-backed and closed a $35 million extension of its seed round in September 2025, bringing total funding to $88 million. Notable Capital, Lightspeed Venture Partners, Dell Technologies Capital and Unusual Ventures are among its investors.

ServiceNow’s governance announcement centers on AI Passport, a cryptographically signed credential that defines an agent’s identity, permitted actions, accessible systems and accountable owner. Issued through ServiceNow’s AI Control Tower governance platform, it is designed to carry those permissions across agents, tools and vendors, with checks performed as work executes. “Without that baseline, every guardrail is just advisory,” said Nenshad Bardoliwalla, ServiceNow’s senior vice president of AI products.

ServiceNow says identifying agents and monitoring their behavior are not enough without enforceable limits on their authority. AI Passport draws on business context from ServiceNow’s configuration management database, governance policies and workflow approvals to set those limits. In a demonstration, ServiceNow configured a third-party customer service agent to process refunds below $25 while disabling unrelated capabilities. An $18 refund proceeded automatically, but a $40 request was rejected at runtime because it exceeded the threshold for human review.

The approach supports graduated responses when agents exceed their authority. Organizations can pause an agent by revoking session tokens, restrict its access to approved tools and endpoints or deactivate it by revoking credentials. Agents can later be restored with a recorded explanation. “It’s more like a dimmer switch,” Bardoliwalla said. “You monitor, you pause, you restrict, and eventually, if necessary, you deactivate.” Nvidia Corp. is a design and launch partner, linking AI Passport with its Open Agent Safety Platform, including the OpenShell secure runtime and Sentry security framework. The integration connects enterprise policies with enforcement inside the infrastructure where agents operate, said Itay Ozery, Nvidia’s director of product marketing for cybersecurity, who described the central challenge as “making your enterprise policy meaningful at the point of execution.” ServiceNow said AI Passport uses open specifications so other governance products, identity providers and enforcement systems can issue and verify credentials. It is intended to support third-party agents as well as ServiceNow’s own.

AI Control Tower is also expanding discovery, observability and financial oversight. Additions include shadow AI detection and more than 400 vendor connectors for discovery, access mapping and monitoring of agent behavior. Cost capabilities track spending by user, department and runtime while connecting consumption and quality with business value. AI Cost Management consolidates spending on frontier models, AI embedded in software services, hyperscalers and data center graphics processing units. A separate Operational Resilience offering brings governance, risk and security together for financial institutions.

ServiceNow’s EmployeeWorks updates extend that governance strategy into daily work. Its third-generation employee-focused AI harness combines reasoning, memory and connections to business systems, with administrator-defined controls over what employees can build and access. Productivity Assistants target work that requires context specific to a job or business function, and employees can customize behavior, information sources and tools. Initial offerings include research and calendaring assistants, along with human resources-focused assistants for talent insights, HR business partners and managers. Productivity Routines handle repeatable work in the background. A sales employee, for example, could automate reviewing upcoming meetings, researching prospects and assembling account materials before the workday begins. “There’s no coding required. It’s drag and configure and deploy all within these guardrails,” said Bhavin Shah, senior vice president of ServiceNow’s employee experience group.

For developers, the new ToolSmith environment builds tools and integrations from natural-language instructions. ServiceNow said ToolSmith is trained on more than 75,000 application programming interfaces and can plan integrations, retrieve logs, suggest fixes and support testing. Shah said it uses governed connectors to read and write enterprise data in a preproduction development environment. A Conversations API lets organizations embed EmployeeWorks capabilities in internal applications, kiosks, messaging services and other AI applications.